59100fd6bc
Much like read-database.ini, we need to ensure the permissions for puppetdb.ini and others are set explicitly to ensure permissions are still correct after configuration. Without this users with different umask settings may find their files are no longer accessible after the module runs. This patch fixes the globally for all the ini files we currently manage (repl.ini is not managed fwiw). This also fixes a bug whereby we were missing puppetdb::server::global from the main server class, it adds this back and fixes the tests to ensure we don't lose it. Signed-off-by: Ken Barber <ken@bob.sh>
46 lines
1.4 KiB
Puppet
46 lines
1.4 KiB
Puppet
# PRIVATE CLASS - do not use directly
|
|
class puppetdb::server::puppetdb (
|
|
$certificate_whitelist_file = $puppetdb::params::certificate_whitelist_file,
|
|
$certificate_whitelist = $puppetdb::params::certificate_whitelist,
|
|
$confdir = $puppetdb::params::confdir,
|
|
$puppetdb_user = $puppetdb::params::puppetdb_user,
|
|
$puppetdb_group = $puppetdb::params::puppetdb_group,
|
|
) inherits puppetdb::params {
|
|
|
|
file { "${confdir}/puppetdb.ini":
|
|
ensure => file,
|
|
owner => $puppetdb_user,
|
|
group => $puppetdb_group,
|
|
mode => '0600',
|
|
}
|
|
|
|
# Set the defaults
|
|
Ini_setting {
|
|
path => "${confdir}/puppetdb.ini",
|
|
ensure => present,
|
|
section => 'puppetdb',
|
|
require => File["${confdir}/puppetdb.ini"],
|
|
}
|
|
|
|
$certificate_whitelist_setting_ensure = empty($certificate_whitelist) ? {
|
|
true => 'absent',
|
|
default => 'present',
|
|
}
|
|
|
|
# accept connections only from puppet master
|
|
ini_setting {'puppetdb-connections-from-master-only':
|
|
ensure => $certificate_whitelist_setting_ensure,
|
|
path => "${confdir}/puppetdb.ini",
|
|
section => 'puppetdb',
|
|
setting => 'certificate-whitelist',
|
|
value => $certificate_whitelist_file,
|
|
}
|
|
|
|
file { $certificate_whitelist_file:
|
|
ensure => $certificate_whitelist_setting_ensure,
|
|
content => template('puppetdb/certificate-whitelist.erb'),
|
|
mode => '0644',
|
|
owner => 0,
|
|
group => 0,
|
|
}
|
|
}
|